you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 3 months ago (2 children)

The article doesn't seem to say. I don't know if it's a problem with defaults or caused by the devs themselves.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 3 months ago

    By default pull requests my new contributors require approval from someone with write-access to the repo before running actions.

    These repos have specifically decided to change a setting to make them not require approval for anyone. The UI to change that setting explicitly warns you about exactly this attack, so this "article" feels like a non-item trying to farm engagement.

  • source
  • parent